Extracted

• • Target

    ec00000af576d2f2b58cf7f354e59a2f_JaffaCakes118

  • Size

    271KB

  • MD5

    ec00000af576d2f2b58cf7f354e59a2f

  • SHA1

    86af0f054ad8ee47aae4cad661bca6b8c36c27e5

  • SHA256

    5d74caaf24b9e66f0342ec0e2abf5b141e6a383c797403b15ba08e14e4b3aba2

  • SHA512

    96d2648da61eadd86d0b387d6dad78c1354855851293943075dd2f50f3728124c3abc8fb721cb5c11df20f07fa14f2023e40096cd6613bce4b233d68f1420960

  • SSDEEP

    6144:ALrGX6ymwgWGcZ+pLIERlbSWIjgisAVO0HJaBdxFO:AJJLIERlWWudfELO

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2